grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. root@kitploit: ➜ ./grafanaExp -h NAME:...

ATTACKdatamap

ATTACKdatamap A datasource assessment on an event level to show potential coverage of the "MITRE ATT&CK" framework. This tool is developed by me and has no affiliation with "MITRE" nor with its great "ATT&CK" team, it is developed with the intention to ease the mapping of data sources to assess...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Python implementation of a tool for decrypting and encrypting sensitive data in Grafana, specifically addressing the vulnerabilities associated with CVE-2021-43798. Grafana encrypts all data source passwords using the AES algorithm with the secretkey found in the defaults.i...

solr_exploit

Disclaimer The vulnerability detection methods, files, and other content provided here are strictly for use by security professionals who have obtained legal authorization, with the purpose of detecting the security of authorized servers. Security professionals must comply with legal regulations...

CVE-2025-70829

CVE-2025-70829：Datart 信息泄露漏洞 1. 漏洞概述 CVE ID : CVE-2025-70829 影响产品 : Datart 版本 : v1.0.0-rc.3 漏洞类型 : 信息泄露 Information Exposure Datart v1.0.0-rc.3 存在信息泄露漏洞，允许经过身份验证的攻击者通过自定义 H2 JDBC 连接字符串访问敏感数据。通过引导应用程序连接到自身的内部数据库文件，攻击者可以查询包含用户凭据和配置详情的系统表。 2. 复现步骤 前置条件 已拥有登录 Datart 仪表板的权限。 操作步骤 1. 登录 到 Datart 系统...

CVE-2026-25212

CVE-2026-25212 – Percona PMM RCE PoC Critical – CVSS 9.9 – Authenticated Remote Code Execution in PMM 3.7. Description This proof‑of‑concept exploits a vulnerability where an internal PostgreSQL user in PMM retains 'SUPERUSER' privileges. An authenticated attacker with 'pmm-admin' rights can abus...

grafanaExp

grafanaExp A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability CVE-2021-43798, it can burst plugins / extract secretkey / decode datasource info automatic. Usage Automatic exploit with exp and local decode dbfile with decode. root@kitploit: ➜ ./grafanaExp -h NAME:...

grafana-ssrf

grafana-ssrf SSRF autenticato in Grafana. Note L'header dei metadati di Azure è stato aggiunto a tutte le SSRF L'header dei metadati di Google è stato aggiunto a tutte le SSRF La SSRF non seguirà i redirect in nessun caso, quindi assicurati che l'URL sia diretto. Se il login avviene tramite SSO o...

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

EUVD-2026-67032

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

cacti-rce-cve-2022-46169-vulnerable-application

Applicazione vulnerabile di Cacti v1.2.22 con comandi injection CVE-2022-46169 Questa è un'applicazione vulnerabile per testare l'exploit per la vulnerabilità Cacti CVE-2022-46169. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo rischio! Si consiglia di...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource...

Astra Linux – Vulnerability in libdbi-perl

A issue was discovered in the DBI module through version 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically specified via the fdir attribute in the data source name DSN. NOTE: This issue exists due to an incomplete fix for CVE-2014-10401...

EUVD-2026-63828

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026...

PT-2026-79313

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 has a broken access control flaw: any user with the Contributor role or above can retrieve every chart's full configuration in a single request, potentially exposing remote data source credentials stored in chart settings. CVSS 3.1 scores this MEDIUM (...

EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19003

MongoDB BI Connector ODBC Driver vulnerability (CVE-2026-19003) affects the driver’s setup dialog for data sources with overly long path settings. The root cause is an incorrect buffer capacity calculation in the dialog’s file/folder selection handling, which can cause the driver to write outside...